             {:keys [status body]} (app req)]
         (is (= 403 status))
         (is (re-matches #"Forbidden.*" body))))))
+
+(deftest ^:integration authorization-check-test
+  (with-test-logging
+    (with-app-with-config
+      app
+      [plumbing-service authorization-service]
+      (assoc-in minimal-config [:authorization :rules] basic-rules)
+      (testing "allowed request"
+        (is (-> (get-service app :PlumbingService)
+                (call-authorization-check
+                 (assoc base-request :uri "/puppet/v3/catalog/test.domain.org"))
+                (rules/authorized?))))
+      (testing "denied request"
+        (is (not (-> (get-service app :PlumbingService)
+                     (call-authorization-check catalog-request-nocert)
+                     (rules/authorized?))))))))

(def unauthenticated-request
  "A basic unauthenticated request to feed into the tests"
  (request "/" :get "127.0.0.1"))

(defn build-ring-handler
  "Build a ring handler around the echo reverse service"

;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;;; Utilities

(def minimal-config
  "Minimal config required to bootstrap AuthorizationService with
  EchoReverseService as a dependant consumer.
